Threat intelligence / Malware

More_eggs

[More_eggs](https://attack.mitre.org/software/S0284) is a JScript backdoor used by [Cobalt Group](https://attack.mitre.org/groups/G0080) and [FIN6](https://attack.mitre.org/groups/G0037). Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. (Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[More_eggs](https://attack.mitre.org/software/S0284) is a JScript backdoor used by [Cobalt Group](https://attack.mitre.org/groups/G0080) and [FIN6](https://attack.mitre.org/groups/G0037). Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. (Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)

Labels

malware

18 recorded

Relationships

uses

from Cobalt Group

Group

uses

Group

uses

from FIN6

Group

uses

to Code Signing

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Internet Connection Discovery

Technique

uses

Technique

uses

to Security Software Discovery

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

10 external

References

mitre-attack

S0284

SKID

—

SpicyOmelette

—

Terra Loader

—

More_eggs

—

Crowdstrike GTR2020 Mar 2020

https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf

ESET EvilNum July 2020

https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/

Talos Cobalt Group July 2018

https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html

Security Intelligence More Eggs Aug 2019

https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/

Visa FIN6 Feb 2019

https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf